Remove the URI limitation from external markdown links
The Markdown Module of Redmine limits the possible URIs in markdown written links (RedmineTextFormattingMarkdown). But for us it is a very important feature to be able to link directly from Redmine to other apps. Therefore we need to be able to set links e.g. with the URI zpl://... (zeplin.io App on MacOS). With Textile this is possible, but not with Markdown.
IMHO the security gain of the limitation is small, especially since there is no limitation with Textile.
Remove the URI limitation in Markdown (/lib/redmine/helpers/uri.rb). Alternatively, the possible URIs could be made adjustable.
Updated by Janeks Kamerovskis over 2 years ago
Declan Jackson wrote:
Simon Busse wrote:
As a note: for us we have solved the problem with a "fix" plugin (https://github.com/laborb/redmine_lab_uri_schemes).
Nevertheless I would consider a solution in the core to be useful.
It is nice to be here...
Updated by Martin Cizek over 2 years ago
In CommonMark formatting patch #32424, I've added
If it were applied, the fix for the old Markdown formatting would be:
--- a/lib/redmine/wiki_formatting/markdown/formatter.rb +++ b/lib/redmine/wiki_formatting/markdown/formatter.rb @@ -27,7 +27,7 @@ module Redmine include Redmine::Helpers::URL def link(link, title, content) - return nil unless uri_with_safe_scheme?(link) + return nil unless uri_with_link_safe_scheme?(link) css = nil unless link && link.starts_with?('/')
This new helper method can then be used also to replace the hardcoded test in Textile (
Updated by Marius BALTEANU over 1 year ago
- Status changed from New to Closed
- Resolution set to Fixed
The old Markdown formatting based on RedCarpet is deprecated and it won't receive any fixes (excepting security issues). You should migrate to the new Markdown formatting based on CommonMark which is available in Redmine 5 (#32424).
I'm setting resolution fixed because this issue is fixed in CommonMark.